[deliverable/linux.git] / net / netfilter / xt_tcpmss.c

/* Kernel module to match TCP MSS values. */

/* Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
 * Portions (C) 2005 by Harald Welte <laforge@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <linux/module.h>
#include <linux/skbuff.h>
#include <net/tcp.h>

#include <linux/netfilter/xt_tcpmss.h>
#include <linux/netfilter/x_tables.h>

#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
MODULE_DESCRIPTION("iptables TCP MSS match module");
MODULE_ALIAS("ipt_tcpmss");

static bool
match(const struct sk_buff *skb,
      const struct net_device *in,
      const struct net_device *out,
      const struct xt_match *match,
      const void *matchinfo,
      int offset,
      unsigned int protoff,
      bool *hotdrop)
{
	const struct xt_tcpmss_match_info *info = matchinfo;
	struct tcphdr _tcph, *th;
	/* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
	u8 _opt[15 * 4 - sizeof(_tcph)], *op;
	unsigned int i, optlen;

	/* If we don't have the whole header, drop packet. */
	th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
	if (th == NULL)
		goto dropit;

	/* Malformed. */
	if (th->doff*4 < sizeof(*th))
		goto dropit;

	optlen = th->doff*4 - sizeof(*th);
	if (!optlen)
		goto out;

	/* Truncated options. */
	op = skb_header_pointer(skb, protoff + sizeof(*th), optlen, _opt);
	if (op == NULL)
		goto dropit;

	for (i = 0; i < optlen; ) {
		if (op[i] == TCPOPT_MSS
		    && (optlen - i) >= TCPOLEN_MSS
		    && op[i+1] == TCPOLEN_MSS) {
			u_int16_t mssval;

			mssval = (op[i+2] << 8) | op[i+3];

			return (mssval >= info->mss_min &&
				mssval <= info->mss_max) ^ info->invert;
		}
		if (op[i] < 2)
			i++;
		else
			i += op[i+1] ? : 1;
	}
out:
	return info->invert;

dropit:
	*hotdrop = true;
	return false;
}

static struct xt_match xt_tcpmss_match[] __read_mostly = {
	{
		.name		= "tcpmss",
		.family		= AF_INET,
		.match		= match,
		.matchsize	= sizeof(struct xt_tcpmss_match_info),
		.proto		= IPPROTO_TCP,
		.me		= THIS_MODULE,
	},
	{
		.name		= "tcpmss",
		.family		= AF_INET6,
		.match		= match,
		.matchsize	= sizeof(struct xt_tcpmss_match_info),
		.proto		= IPPROTO_TCP,
		.me		= THIS_MODULE,
	},
};

static int __init xt_tcpmss_init(void)
{
	return xt_register_matches(xt_tcpmss_match,
				   ARRAY_SIZE(xt_tcpmss_match));
}

static void __exit xt_tcpmss_fini(void)
{
	xt_unregister_matches(xt_tcpmss_match, ARRAY_SIZE(xt_tcpmss_match));
}

module_init(xt_tcpmss_init);
module_exit(xt_tcpmss_fini);
Commit	Line	Data
1da177e4 LT	1	/* Kernel module to match TCP MSS values. */
	2
	3	/* Copyright (C) 2000 Marc Boucher <marc@mbsi.ca>
2e4e6a17	4	* Portions (C) 2005 by Harald Welte <laforge@netfilter.org>
1da177e4 LT	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*/
	10
	11	#include <linux/module.h>
	12	#include <linux/skbuff.h>
	13	#include <net/tcp.h>
	14
2e4e6a17 HW	15	#include <linux/netfilter/xt_tcpmss.h>
	16	#include <linux/netfilter/x_tables.h>
	17
1da177e4	18	#include <linux/netfilter_ipv4/ip_tables.h>
2e4e6a17	19	#include <linux/netfilter_ipv6/ip6_tables.h>
1da177e4	20
1da177e4 LT	21	MODULE_LICENSE("GPL");
	22	MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
	23	MODULE_DESCRIPTION("iptables TCP MSS match module");
2e4e6a17	24	MODULE_ALIAS("ipt_tcpmss");
1da177e4	25
1d93a9cb	26	static bool
ce556b3a PM	27	match(const struct sk_buff *skb,
	28	const struct net_device *in,
	29	const struct net_device *out,
	30	const struct xt_match *match,
	31	const void *matchinfo,
	32	int offset,
	33	unsigned int protoff,
cff533ac	34	bool *hotdrop)
1da177e4	35	{
ce556b3a	36	const struct xt_tcpmss_match_info *info = matchinfo;
1da177e4 LT	37	struct tcphdr _tcph, *th;
	38	/* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
	39	u8 _opt[15 * 4 - sizeof(_tcph)], *op;
	40	unsigned int i, optlen;
	41
	42	/* If we don't have the whole header, drop packet. */
2e4e6a17	43	th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
1da177e4 LT	44	if (th == NULL)
	45	goto dropit;
	46
	47	/* Malformed. */
	48	if (th->doff4 < sizeof(th))
	49	goto dropit;
	50
	51	optlen = th->doff4 - sizeof(th);
	52	if (!optlen)
	53	goto out;
	54
	55	/* Truncated options. */
2e4e6a17	56	op = skb_header_pointer(skb, protoff + sizeof(*th), optlen, _opt);
1da177e4 LT	57	if (op == NULL)
	58	goto dropit;
	59
	60	for (i = 0; i < optlen; ) {
	61	if (op[i] == TCPOPT_MSS
	62	&& (optlen - i) >= TCPOLEN_MSS
	63	&& op[i+1] == TCPOLEN_MSS) {
	64	u_int16_t mssval;
	65
	66	mssval = (op[i+2] << 8) \| op[i+3];
601e68e1	67
ce556b3a	68	return (mssval >= info->mss_min &&
601e68e1	69	mssval <= info->mss_max) ^ info->invert;
1da177e4	70	}
ce556b3a PM	71	if (op[i] < 2)
	72	i++;
	73	else
	74	i += op[i+1] ? : 1;
1da177e4 LT	75	}
1da177e4 LT	76	out:
ce556b3a	77	return info->invert;
1da177e4	78
ce556b3a	79	dropit:
cff533ac	80	*hotdrop = true;
1d93a9cb	81	return false;
1da177e4 LT	82	}
1da177e4 LT	83
9f15c530	84	static struct xt_match xt_tcpmss_match[] __read_mostly = {
4470bbc7 PM	85	{
	86	.name = "tcpmss",
	87	.family = AF_INET,
	88	.match = match,
	89	.matchsize = sizeof(struct xt_tcpmss_match_info),
	90	.proto = IPPROTO_TCP,
	91	.me = THIS_MODULE,
	92	},
	93	{
	94	.name = "tcpmss",
	95	.family = AF_INET6,
	96	.match = match,
	97	.matchsize = sizeof(struct xt_tcpmss_match_info),
	98	.proto = IPPROTO_TCP,
	99	.me = THIS_MODULE,
	100	},
1da177e4 LT	101	};
1da177e4 LT	102
65b4b4e8	103	static int __init xt_tcpmss_init(void)
1da177e4	104	{
4470bbc7 PM	105	return xt_register_matches(xt_tcpmss_match,
4470bbc7 PM	106	ARRAY_SIZE(xt_tcpmss_match));
1da177e4 LT	107	}
1da177e4 LT	108
65b4b4e8	109	static void __exit xt_tcpmss_fini(void)
1da177e4	110	{
4470bbc7	111	xt_unregister_matches(xt_tcpmss_match, ARRAY_SIZE(xt_tcpmss_match));
1da177e4 LT	112	}
1da177e4 LT	113
65b4b4e8 AM	114	module_init(xt_tcpmss_init);
65b4b4e8 AM	115	module_exit(xt_tcpmss_fini);